Security? Don't bother until it's needed says RFC
All-or-nothing approaches to security are part of what's making it so hard to achieve acceptable protection, a new RFC suggests.
Written by Viktor Dukhovni of Two Sigma, RFC 7435 argues that the way current systems fail is a discouragement to good security. A binary failure – if two peers in a conversation don't have the same capabilities, the connection fails – can result in users avoiding encryption, for example, because it's too inconvenient; or administrators switching off because user problems are too frequent.
If it's easy to gracefully upgrade the security available to an end user, rather than the often fatal downgrade when there's an interop or capability mismatch, adoption should increase he argues. “Security services that work reliably (when not under attack) are more likely to be deployed and enabled by default”, the RFC states.
